ISO 42001 Gap Assessment

Category: Research & Analysis | Uploader: pifpof | Downloads: 0 | Version: v1.0（Latest）

Conducts a structured gap assessment of an organization's readiness against ISO 42001:2023 (AI Management System standard). Runs an interview-style evaluation across all mandatory clauses (4-10) and applicable Annex A controls. Produces a scored gap assessment report saved to the vault, a draft Statement of Applicability, and a prioritized list of gaps to address before certification. Requires a vault created by /setup-iso42001-vault.

Changelog: Source: GitHub https://github.com/pifpof/iso42001

Directory Structure

Current level: tree/main/.claude/commands/iso42001-assess/

📁 assets/
- 📄 01-context-questions.md 3.8 KB
- 📄 02-leadership-questions.md 4.2 KB
- 📄 03-planning-questions.md 5.2 KB
- 📄 04-support-questions.md 5.7 KB
- 📄 05-operation-questions.md 6.2 KB
- 📄 06-evaluation-questions.md 4.1 KB
- 📄 07-improvement-questions.md 3.2 KB
- 📄 08-annex-a-questions.md 12.0 KB
- 📄 assessment-report-template.md 4.9 KB
📁 references/
- 📄 clause-map.md 6.5 KB
- 📄 scoring-rubric.md 4.1 KB
📄 SKILL.md 6.4 KB

SKILL.md

---
name: ISO 42001 Gap Assessment
description: "Conducts a structured gap assessment of an organization's readiness against ISO 42001:2023 (AI Management System standard). Runs an interview-style evaluation across all mandatory clauses (4-10) and applicable Annex A controls. Produces a scored gap assessment report saved to the vault, a draft Statement of Applicability, and a prioritized list of gaps to address before certification. Requires a vault created by /setup-iso42001-vault."
---

# ISO 42001 Gap Assessment

## Purpose

Systematically assess the organization's current maturity against ISO 42001 through a structured, conversational interview. Score each clause and Annex A control on the 0–4 maturity scale. Produce a complete gap assessment report with prioritized findings.

---

## Pre-flight Check

**Step 1 — Check for vault**

Look for `vault.config.md` in the current working directory. If it doesn't exist:
> "No ISO 42001 vault found in this directory. Please run `/setup-iso42001-vault` first to set up your company profile and AI system inventory. This assessment needs that context to be useful."

Stop and wait for the user to run setup.

**Step 2 — Read context**

Read:
- `vault.config.md` — progress state and AI systems summary
- `memory/company-context.md` — company and AI system details
- `inputs/company-profile.md` — full intake context
- `inputs/existing-docs/` — any existing policies or documentation

Check whether a previous assessment exists (`memory/assessment-results.md`). If it does:
> "I found a previous assessment from [date]. Would you like to:
> 1. Run a full re-assessment (recommended if significant changes have occurred)
> 2. Reassess specific areas only
> 3. Review the previous results"

---

## Assessment Workflow

Tell the user upfront:

> "This assessment covers all 7 mandatory clauses and 38 Annex A controls of ISO 42001. It's thorough — expect 45–90 minutes depending on how much governance you already have in place. I'll work through one section at a time and summarize findings as we go. You can pause and resume at any time.
>
> I'll be asking about what's documented and practiced, not just what's planned. Be honest — the more accurate the picture, the more useful the roadmap will be.
>
> Ready? Let's start with Clause 4."

### Module execution order

Run each module in order. For each module:

1. Introduce the clause/domain briefly (2–3 sentences, plain English)
2. Read the relevant asset file for the question set
3. Ask questions conversationally — not as a numbered list. Follow up on answers to probe deeper where needed
4. At the end of each module, summarize the scores and key findings back to the user for confirmation
5. Record scores before moving to the next module

**Module sequence:**
1. `assets/01-context-questions.md` → Clause 4
2. `assets/02-leadership-questions.md` → Clause 5
3. `assets/03-planning-questions.md` → Clause 6
4. `assets/04-support-questions.md` → Clause 7
5. `assets/05-operation-questions.md` → Clause 8
6. `assets/06-evaluation-questions.md` → Clause 9
7. `assets/07-improvement-questions.md` → Clause 10
8. `assets/08-annex-a-questions.md` → Annex A controls

**Between modules**, offer:
> "That's Clause [X] complete. Your score: [X.X/4]. [Key finding in one sentence.]
> Ready to move on to Clause [Y]?"

---

## Scoring

Use `references/scoring-rubric.md` throughout. Score conservatively based on evidence described, not intent.

Maintain a running score table as you go:

```
Clause 4:  [score]
Clause 5:  [score]
...
```

Flag certification blockers immediately when they appear:
> "⚠️ **Certification blocker**: [Company Name] doesn't currently have a documented AI Policy (Clause 5.2). This is required for certification. I'll flag this as a critical gap in the report."

---

## Report Generation

After all 8 modules are complete:

**Step 1 — Calculate scores**

Using `references/scoring-rubric.md`:
- Calculate clause average scores
- Calculate Annex A domain scores
- Calculate overall AIMS maturity score
- Identify critical, high, medium, and low priority gaps

**Step 2 — Present summary**

Show the user:
> "**Assessment complete.**
>
> Overall maturity: [X.X / 4.0] — [readiness band]
>
> Top 3 gaps:
> 1. [gap]
> 2. [gap]
> 3. [gap]
>
> [n] certification blocker(s) identified: [list]
>
> Generating your full report now..."

**Step 3 — Write report**

Using `assets/assessment-report-template.md`, generate and write the complete gap assessment report to:

`outputs/gap-assessment-report.md`

Fill all sections: executive summary, clause scores, Annex A scores, priority gaps table, detailed findings per clause, SoA draft, recommended next steps.

**Step 4 — Write assessment results to memory**

Write a structured summary to `memory/assessment-results.md` (used by roadmap and policy skills):

```markdown
# Assessment Results — [Company Name]
**Date**: [date]
**Overall Score**: [X.X / 4.0] — [readiness band]

## Clause Scores
- Clause 4 (Context): [X.X] — [key gap in one line]
- Clause 5 (Leadership): [X.X] — [key gap]
- Clause 6 (Planning): [X.X] — [key gap]
- Clause 7 (Support): [X.X] — [key gap]
- Clause 8 (Operation): [X.X] — [key gap]
- Clause 9 (Evaluation): [X.X] — [key gap]
- Clause 10 (Improvement): [X.X] — [key gap]

## Annex A Domain Scores
- A.2 (Policies): [X.X]
- A.3 (Organization): [X.X]
- A.4 (Resources): [X.X]
- A.5 (Impact Assessment): [X.X]
- A.6 (Lifecycle): [X.X]
- A.7 (Stakeholder Info): [X.X]
- A.8 (Use of AI): [X.X]
- A.9 (Responsible AI): [X.X]
- A.10 (Ecosystem): [X.X]

## Priority Gaps
### Critical (Certification-Blocking)
1. [gap with clause ref]

### High Priority
1. [gap with clause ref]
2. ...

### Medium Priority
1. ...

## Excluded Controls
- [control]: [reason]

## AI Systems Assessed
- [system 1]: [brief note]
- [system 2]: ...
```

**Step 5 — Update vault.config.md**

Mark the assessment as complete:
```
- [x] Gap assessment (iso42001-assess) — [date], score [X.X/4.0]
```

---

## Completion Message

```
✓ Gap assessment complete
✓ Report written to: outputs/gap-assessment-report.md
✓ Assessment data saved to: memory/assessment-results.md

Overall maturity: [X.X / 4.0] — [readiness band]
[n] certification blocker(s) | [n] high-priority gaps

Suggested next steps:
→ /iso42001-roadmap    Generate your certification roadmap
→ /iso42001-policy     Generate policy and procedure documents
→ /iso42001-brief      Deep-dive on any specific clause or control
```

Comments 0

Latest | Hot

Please login before commenting.

Loading comments...

ISO 42001 Gap Assessment

Directory Structure

SKILL.md

Report

Notice